This security advisory describes one low risk vulnerability.
The vulnerability allows a local attacker to execute arbitrary code on the target device.
The vulnerability exists due to insufficient validation of user-supplied input. An attacker with physical access to the device can insert an SD card containing a file named "zskj_script_run.sh" that executes arbitrary code.Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.Vulnerable software versions
Keeper K5: -, 18.104.22.168, 22.214.171.124CPE
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.